Solving Low-Density Subset Sum Problems...The subset sum problem is a well-known NP-complete set recognition problem [8, p. 2261. The problem is stated as follows: Given a set A =

Solving Low-Density Subset Sum Problems

J. C. LAGARIAS AND A. M. ODLYZKO

AT&T Bell Laboratories, Murray Hill, New Jersey

Abstract. The subset sum problem is to decide whether or not the O-1 integer programming problem ” C aixi = M, Vi,x,=O or 1,

i-l

has a solution, where the ai and M are given positive integers. This problem is NP-complete, and the difficulty of solving it is the basis of public-key cryptosystems of knapsack type. An algorithm is proposed that searches for a solution when given an instance of the subset sum problem. This algorithm always halts in polynomial time but does not always find a solution when one exists. It converts the problem to one of finding a particular short vector v in a lattice, and then uses a lattice basis reduction algorithm due to A. K. Lenstra, H. W. Lenstra, Jr., and L. Lovasz to attempt to find v. The performance of the proposed algorithm is analyzed. Let the density d of a subset sum problem be defined by d = n/log2(maxi ai). Then for “almost all” problems of density d c 0.645, the vector v we searched for is the shortest nonzero vector in the lattice. For “almost all” problems of density d < l/a it is proved that the lattice basis reduction algorithm locates v. Extensive computational tests of the algorithm suggest that it works for densities d < de(n), where d=(n) is a cutoff value that is substantially larger than I/n. This method gives a polynomial time attack on knapsack public-key cryptosystems that can be expected to break them if they transmit information at rates below d=(n), as n -+ 01.

Categories and Subject Descriptors: E.3 [Data Encryption]: Public Key Cryptosystems; F.2.1 [Analysis of Algorithms and Problem Complexity]: Numerical Algorithms and Problems-number-theoretic computations; G.2.0 [Discrete Mathematics]: General

General Terms: Algorithms, Theory

Additional Key Words and Phrases: Knapsack public-key cryptosystem, subset sum problems, integer lattice, L’ algorithm

1. Introduction The subset sum problem is a well-known NP-complete set recognition problem [8, p. 2261. The problem is stated as follows: Given a set A = (ai: 1 I i 5 n) of positive integers and a positive integer M, recognize when some subset of A has sum equal to a given integer 44. We consider the related NP-hard algorithmic problem: Find a feasible solution to the O-l integer programming problem

j, &xi = My V&Xi=0 or 1, (1.1)

when one exists.

A preliminary version of this paper appeared in Proceedings of the 1983 IEEE 24th Annual Symposium on the Foundations ofcomputer Science. IEEE, New York, 1983, pp. l-10.0 IEEE 1983. Authors’ address: AT&T Bell Laboratories, 600 Mountain Avenue, Murray Hill, NJ 07974. Permission to copy without fee all or part of this material is granted provided that the copies are not made or distributed for direct commercial advantage, the ACM copyright notice and the title of the publication and its date appear, and notice is given that copying is by permission of the Association for Computing Machinery. To copy otherwise, or to republish, requires a fee and/or specific permission. 0 1985 ACM 0004-541 l/85/0100-0229 $00.75

Journal ofthe Association for Computing Machinery, Vol. 32, No. I, January 1985, pp. 229-246.

230 J. C. LAGARIAS AND A. M. ODLYZKO

Several proposed public-key cryptosystems, called knapsack public-key cryptosystems, are based on this problem [ 12, 15, 181. Such cryptosystems give a set of weights (ai: 1 5 i 15 n) as public information. A plaintext message consisting of a O-l vector (e,, . . . , e,) is encrypted using (1. I), the integer M being the ciphertext. The problem of decrypting an encrypted message M is, therefore, an instance of (1.1). In such cryptosystems the weights {ai: 1 5 i 5 n] are chosen in such a way that (1.1) can be ea.sily solved if certain secret information, called a trapdoor, is known. In particular, the sets of weights (a;: 1 I i I n) used in such cryptosystems form a very special subclass of subset sum problems (1.1). In 1982 Shamir [ 171 announced a method for breaking the simplest such public-key cryptosystem, the basic Merkle-Hellman cryptosystem. Since then several attacks on more complicated knapsack cryptosystems have been proposed [ 1, 11, 161. These attacks are all based on the idea of recovering the trapdoor information concealed in the weights (ai: 1 5 i 5 .u).

In this paper we propose a simple method, which we call Algorithm SF’, for directly locating a feasible solution to (1.1). Let a = (al, . . . , a,). The method consists of transfomring (1.1) to the problem of finding a particular short vector e in an integer lattice L = L(a, M). Then we apply a lattice basis reduction algorithm to produce a reduced basis of the lattice. This algorithm is due to A. K. Lenstra, H. W. Lenstra, Jr., and L. LovLsz [ 131; we call it the L3 algorithm. The method succeeds if fe appears in the reduced basis; a solution to ( 1.1) follows immediately from e.

Since the problem ( 1.1) is NP-hard, Algorithm SV cannot always be expected to succeed. We analyze the circumstances under which it can be expected to work. We define the density d(a) of a set of weights a = (a,, . . . , a,) by

d(a) = ’ lOgz(maXi ai) .

In terms of knapsack public-key cryptosystems, d(a) is an approximate measure of the information rate at which bits are transmitted; that is,

d(a) G number of bits in plaintext message

average number of bits in cipher-text message ’

Our main result is a performance analysis of Algorithm SV, which shows that it succeeds for “low-de:nsity” subset sum problems as follows:

(1) For “almost all”’ subset sum problems with d(a) < 0.645, the vector e is the shortest nonzero vector in the lattice L = L(a, M). (See Theorem 3.3.)

(2) For “almost all”’ solvable subset sum problems with n weights having d(a) < (2 - E) (log2 4/3)-‘n-l, for any fixed c > 0, Algorithm SV finds a solution. (See Theorem 3.5 and the remark following its proof.)

We believe that the first result is essentially the best possible in the sense that it is no longer true when 0.645 is replaced by 0.646. (Our belief is based on heuristic arguments that we describe in Section 5.)

The second result is weaker than what we believe to be true. The reason for this is as follows. The L3 algorithm is not guaranteed to produce the shortest nonzero vector Xmin in a lattice L G Z”, but only a relatively short vector. To prove that the algorithm succeeds on “almost all” problems with n weights having density d(a) < (2 - C) (log2 (4/3))-‘n-l, we use a worst-case bound on the length of the shortest vector found by the L3 algorithm (Proposition 2.1). Empirical experience with the

Solving Low-Density Subset Sum Problems 231

L3 algorithm suggests that it usually finds considerably shorter vectors than those guaranteed by this bound. Computational evidence suggests that the algorithm succeeds on “almost all” problems with n items for which d(a) < d,(n) where d,(n) is a cutoff value that is substantially larger than 2(log2 (4/3))-‘n-l. We do not have enough data to make a reasonable guess on the behavior of &(a), but it seems likely that d,(n) + 0 as y1+ 00. (See Section 4 for more details.)

The algorithm we present uses the L3 algorithm because it is currently the only algorithm known for finding short vectors in a lattice that has been rigorously proved both to have a polynomial running time and to find reasonably short vectors in a lattice. Instead in Algorithm SV, one could use modifications of other algorithms for finding short vectors in a lattice or for finding good multidimensional Diophantine approximations such as those described in [2], [4], [6], and [7]; these might perform well in practice.

What are the consequences of these results for breaking knapsack-type public- key cryptosystems? First, the empirical evidence implies that this method will very likely break nearly all knapsack cryptosystems for which d(a) < &(n) in polynomial time. In particular, it may well break “almost all” ultimate knapsack cryptosystems of Shamir [ 181, since these cryptosystems have d(a) < l/logln. Second, this method complements the existing attacks on knapsack cryptosystems that are based on recovering trapdoor information. When the information rate is low, the method described here should succeed. When the information rate is high, the trapdoor information is more difficult to conceal, and attacks based on finding the trapdoor are more likely to succeed, see [ 111.

Brickell [ 51 has developed another method to solve general subset sum problems, which can be expected to break most “low-density” problems. Although his method is superficially dissimilar to our method, its success seems to be based on the same basic principles. His method is more complicated and seems difficult to analyze in detail theoretically. Some further remarks on Brickell’s algorithm are made in Section 5.

2. The Method Before describing the method, we state the basic facts about integer lattices and the L3 algorithm that we shall use.

We present the vector space R” using row vectors, and define the length (i.e., Euclidean norm) 11 v 11 of a vector v = (vl, . . . , v,) by

II v II * = iI d- (2.1)

An integer lattice L is an additive subgroup of Z” that contains n linearly inde- pendent vectors over R”. An (ordered) basis [vr, . . . , v,] of a lattice L is a set of elements of L such that L = Zv, CB Zv2 fI3 . . . @ Zv,. We represent an ordered basis of a lattice L by the n x n basis matrix

VI v= :

11 V,

whose rows are the basis vectors. If V, and V2 are basis matrices of the same lattice L, then there is a unimodular matrix U E GL(n, Z) such that

uv, = v,.


Conversely, if V is a basis matrix of L and U E GL(n, Z), then UV is a basis matrix of L. Lenstra et al. (define the notion of a reduced (ordered) basis [vr, . . . , v,] of a lattice L. For the Ipurpose of this paper, we do not need to know the precise definition of a reduced basis (it is given in the Appendix); we need only know that any reduced basis contains a relatively short vector [ 13, prop. 1.111.

PROPOSITION 2.1. Let [vl, . . . , v,] be a reduced basis of a lattice L. Then

(Iv, )I2 5 2”-%;; IIxl12. (2.2) x+0

In fact, all of the basis vectors in a reduced basis tend to be short [ 13, prop. 1.121; we take advantage of this in our method. Lenstra et al. [ 131 present an algorithm, which we call the L3 algorithm, that, when given a basis [v,, . . . , v,] of a lattice L as input, produces a reduced basis [w,, . . . , w,] as output. They give the following polynomial worst-case running time bound for its performance [ 13, prop. 1.261.

PROPOSITION 2.2. Let [v,, . . . , v,] be a basis of an integer lattice L such that I] v; ]I 2 5 B for 1 I i I n. Then the L3 algorithm produces a reduced basis [w,, . . . , w,] for L using at most O(n410g B) arithmetic operations, and the integers on which these operations are performed have binary length at most O(n log B).

If we use the classical algorithms for addition, subtraction, multiplication, and division, this algorithm has a guaranteed running time of O(n6(log B)3) bit operations. There are some practical speedups possible for this algorithm so that it seems possible in practice to find a reduced basis in O(n(log B)3) bit operations. (See Section 4, [9], and [ 161.)

Now we can describe the method. We suppose we are given a vector a = (a,, . . . > a,,) of positive integers and an integer M. Our object is to find a feasible solution to

j, ai& = M Vi,&=0 or 1. (2.3)

We need only consider the case that 1 5 M < CY=r ai. We use the following algorithm.

Algorithm SV (SV == Short Vector) (1) Take the following vectors as a basis [b,, . . . , b,+,] for an n + l-dimensional integer

lattice L = L(a, M):

b, = (1, 0, . . .) 0, -a,) b2 = (0, 1, . . . ) 0, -&)

(2.4) bn =(O,O )...) 1,-a,) b n+, = (0, 0, . . . , 0, M).

(2) Find a reduced basis [by, . . . , bn*+J of L using the L3 algorithm. (3) Check if any bf= (bEI, . . . , bTn+,) has all b$ = 0 or X for some fixed X for 1 (j zs n. For

any such b: check whether Xj = X-’ b?j for 1 5 j 5 n gives a solution to (2.3), and if so, halt. Otherwise, continue.

(4) Repeat steps (l)-(.3) with M replaced by M’ = x7=, a, - M. Then halt.

If Algorithm SV produces a solution to (1) we say it succeeds; otherwise, it fails. Since Algorithm SV is essentially two applications of the L3 algorithm, we

immediately obtain the following running time bound.


LEMMA 2.3. Let (a;: 1 5 i I n) and M < CY=, a; be given as input to Algorithm SV, and suppose max ai I B. Then Algorithm SV halts after at most O(n6(lognB)3) bit operations.

3. Performance Analysis Our goal is to analyze the performance of Algorithm SV on a class of subset sum problems

i UiXi = M, Vi, Xi = 0 or 1, (3.1) i=l

that are known to have a solution. To this end, we suppose that (3.1) has a particular distinguished O-l solution (e,, . . . , e,,), which we treat as fixed, and that

lsieiI?Z-1; i=l

that is, we exclude the trivial cases where M = 0 or X7-, ai. We set e = (ei, . . . , en, 0).

We analyze the performance of Algorithm SV over a sample space of lattices. We define this sample space A(B, e) to consist of all lattices L(a, M) defined by (2.4) such that

a = (a,, . . . , a,) has 1 I ai I B for all i, (3.2) n

M = M(a, e) = i aiei. i=l

(3.3)

In particular there is exactly one lattice L(a, M) in A(B, e) for each a satisfying (3.2); hence h(B, e) contains exactly B” lattices. The distinguished vector e is in all the lattices in the sample space A(B, e) since (2.4) and (3.2) give

e = i eibi + b,+l. i=l

(3.4)

The connection between the sample space A(B, e) and the density d(a) of its associated subset sum problems is as follows. All subset sum problems (3.1) associated with lattices in A(B, e) have

d(a) I L logz B ’ (3.5)

and every a satisfying (3.5) contributes exactly one lattice to A(B, e). Furthermore, for any t > 0 the fraction of lattices in A(B, e) with

d(a) 5 logz(B; - E))

goes to 1 as n + UJ if 1ogzB - cn for some c > 0. Consequently, the sample space A(B, e) may be regarded as sampling subset sum problems of density n/log2B.

We can now formulate the problem we want to solve as follows: Determine how often Algorithm SV finds the distinguished vector e, when applied to all the lattices in the sample space A(B, e). This problem is intimately tied to the question: How short is e relative to other short vectors in the lattices in A(B, e)? We consider this question first.

The expected length of other short vectors in lattices in A(B, e) other than the distinguished vector e can be determined using Theorem 3.1 below. The bound


given by Theorem 3.1 involves the number of lattice points in spheres in n- dimensional space:. We define S,(R) to be the number of integer solutions to the inequality

i x: 5 R, i=l

(3.6)

that is, the number of integer lattice points inside or on the n-dimensional sphere of radius fi centered at the origin.

THEOREM 3.1. The number of lattices L(a) in the sample space h(B, e) that contain a vector w such that

(i) w # k e for all integers k, (ii) 11 w 11’ 5 R,

is

O(R &(R)B”-’ log(BR)). (3.7)

PROOF. Let T = T(R, B, e) denote the number of such lattices. Let w = (WI, . . . , w,, r) E lZ”+’ be a fixed vector satisfying

11 w II2 = f, wf + r2 I R (3.8)

and suppose that w # k e for every integer k. We count how many lattices L(a) in h(B, e) contain w. If w E L(a), then expressing w in of L(a) gives

terms of the basis vectors (2.4)

W = i wibi + Xb,+l i=l

for some integer A. In particular, evaluating the last coordinate of (3.9) gives

(3.9)

n

and using (3.3) gives

r = 2 WiUi - AM(a), i=l

r = i (Wi - Xei)Ui. i=l

(3.10)

(3.11)

We can easily bound X using (3.10); we obtain

1x1 MI It-1 + i (WiUiI 5 B(lrl + i IWil) I RB (3.12) i=l i=l

using (3.Q since r and the Wi are integers, so that A4 L 1 implies

1x1 5 RB. (3.13)

Next we note that since e # 0, it has a nonzero coordinate, which we suppose to be el for convenience in subsequent calculations. Then

M = M(a) = M(a, e) L ale1 = al, (3.14)

so that (3.12) gives

RB alsK, if X # 0.


Also we note that (3.8) implies

1 rI P RI’*. (3.16)

Now we commence counting. Let N(w, X) denote the number of lattices L(a) in h(B, e) for which w is in L(a) and for which h satisfies (3.9). Then (3.13) gives

Ts C’ 1

“c” NW, v 11 w II%R A=-RB 1

> (3.17)

where the prime in the summation indicates that all w with

w = ke; k an integer; (3.18)

are excluded. To estimate this sum, we divide the sum on the right side of (3.17) into four sums, depending on the value of the auxiliary vector

2 = z(w, A) = (w, - Xel, . . . , w, - Ae,) (3.19)

and the value of X.

Cusel. z=O.

In this case (3.19) gives

for some Nf 0. Then

w = (Ae,, . . . , he,, N) (3.20)

w - Xe = (0, . . . , 0, N)

is in L(a), so that necessarily N = kM(a) for some integer k. If k = 0, then w = Xe, which is ruled out by hypothesis (i). Hence 1 k 1 > 1 and

Ilwll 2 IMa)I 2 a~, using (3.14). The condition 11 w ll* < R implies that

aI 5 R’/*.

Consequently, we obtain the bound

N(w, A) 5 R1/*B”-I.

(3.21)

Now there are no more than S,(R) choices of w, and each such w uniquely determines X via (3.20), so that

c N(w, A) = O(R”*&(R)B”-I). (3.22) Case 1

Case2. wr-Xer#Oandwj-Xej=Ofor2Ijrn.

In this case, (3.11) gives

r = (w, - he&,.

Together with (3.16), this gives

1 5 ai I R112,

so that

for such pairs (w, X).

N(w, A) 5 R’/*B”-’

(3.23)

(3.24)

(3.25)


How many such pairs (w, A) can occur? We have the bound

1 WI 1 < R”2

from (3.8), while (3.23) and (3.16) yield

(3.26)

1 WI - XelI 5 L 5 R “2. a1

Combining (3.26:) ;and (3.27) and using el = 1 give

1 X 1 s 2R”2.

The values of (~2, . . . , w,) are all determined by

Wj = Xej,

(3.27)

(3.28)

so that there are O(R) choices of pairs (w, A) in Case 2. Hence

c. N(w, A) = O(R3’2B”-‘). case2

(3.29)

Case 3. wj - XlFj # 0 for some j L 2, and X # 0.

Consider w and X as fixed. Now by (3.15) there are at most RI?/)\ choices for al. Now choose all the other ai arbitrarily, except for i = j. There are Bnm2 such choices. For each such choice, there is at most one possible choice for Uj, since aj is determined by eq. (3.1 l), since Wj - Xej # 0. Hence in this case

Hence

5 2RB”-‘S,,(R) z $.

Since RB

zl ; = WxdRBN,

this yields

2 iV(w, A) = O(RS,(R)B”-‘log(RB)). case3

Case 4. Some wj - Xej # 0 for j z 2 and X = 0.

(3.31)

Consider w as fixed. In this case we can pick all ai except aj arbitrarily, and there are B”-* such choices. There are at most 2R ‘I2 -t 1 choices for aj, since it must satisfy (3.11) and t.here are at most 2R ‘I2 + 1 choices of r by (3.16). Hence in this case

N(w, 0) 5 (2R”2 + l)B”-‘.

Consequently, summing over all w gives

x N(w, A) I (2R”2 + l)S,(R)B”-‘. Case4

(3.32)


Theorem 3.1 follows on combining the bounds (3.22), (3.29), (3.31), and (3.32) and the trivial inequality S,(R) r R. 0

We remark that the dependence on B in Theorem 3.1 cannot be much improved, since all L(a, M) for which aI = ~22 contain the short vector w = (1, - 1, 0, 0, . . . , 0) which satisfies the conditions of Theorem 3.1, and there are B”-’ such lattices in A(B, e). It is an interesting question as to whether or not substantial improvement is possible in the dependence on R in (3.7).

To apply Theorem 3.1, we need explicit estimates for the number of lattice points in spheres. A general principle here is that S,(R) should be equal to the volume V,,(R) of a sphere of radius R ‘I*, with an error proportional to the surface area A,(R) of such a sphere. Now

I/,(R) = c,,R”/*, (3.33) A,(R) = nc,,R(“-‘)/2,

where

(3.34)

is the volume of an n-dimensional sphere of radius 1. For large R one has Vn(R) much larger than A,,(R), but for R small enough, say R = ~uy1, this is not true, and spheres of this radius centered at the origin contain many more lattice points than their volume would suggest. It turns out, furthermore, that for n-dimensional spheres of such small radius (an) , ‘I2 the number of lattice points in the sphere depends strongly on the location of the center of the sphere [ 141. For our application we need a good upper bound for S,,(~ n), and to obtain it we use the following simplified version of the proof in [ 141.

THEOREM 3.2. For all n I 1, S&n) 5 2’.54725n.

PROOF. Let 19(z) = 1 + 2 CE, zi2. Let r,(k) count the number of solutions to

Then

;, x: = k.

[WI” = j. mWk.

Now for x 2 0 we have

S&n) = k_C, Gk) -=a

5 enax *c, r,,(k)e-k”

=e “““[~(e-x)]“,

since for x r 0 we have

(3.35)

e naxe-kr 2 1 when k I ncu.

Now set

a((~, x) = ax + In 8(emX)

238

and observe that (3.35) gives

J. C. LAGARIAS AND A. M. ODLYZKO

Sn(an) 4 ,na = p&dN~J)~~ (3.36)

We are interested in (Y = $ and choose x 2 0 to optimize (3.36); the value x = x0 = 0.997994 is a nearly optimal choice. Then

S(+, x0) 5 1.07247

and

(logze)b(i, x0) 5 1.54725. 0

We remark that the constant 1.54725 in Theorem 3.2 is the best possible to within one unit in the last decimal place (see [ 141).

Now we prove ;a result about short vectors in lattices in the class h(B, e) where e satisfies

” 1 e; 5 $2.

i=l (3.37)

The reason we consider this extra condition is that Algorithm SV examines two lattice problems, one of which is a lattice L(a, e) and the other L(a, e*) where e* = (et . * * , e,*> is the O-l vector complementary to e; that is, et= 1 - ei for all i. Since

min(j,e,, i,et) 5 tn,

the hypothesis (3.37) applies to at least one of these lattice problems.

THEOREM 3.3. Let e be a O-l vectorfor which CZ, ei I n/2. Then ifB = 2”” for any constant @ > 1.54725, the number of lattices L in h(B, e) for which e is the nonzero vector of shortest Euclidean norm in L is

B” + O(Bn-CI(P)(ZogB)2)

where c&3) = 1 - 1.54725/p > 0.

This theorem a:sserts that, under the stated hypotheses, “almost all” the lattices in h(B, e) have e as the shortest vector. In particular, for B = 2@” the density d(a) of lattices in A(B, e) is p-l, so that this theorem applies to sets of lattices with density less than (1.54725)-l = 0.645.

PROOF OF THEOREM 3.3. Theorem 3.1 estimates the number of such lattices by

B” + O(nS&n)B”-’ log(B,)).

Applying Theorern 3.2 gives S,(in) 5 2’.54725n 5 B’-Cl(fl),

where B 2 2? Finally nlog B, = O((log B)‘) for B L 2O”, and the theorem follows. 0

Theorem 3.3 gave a result when the vector e is fixed. We can immediately derive a result where e varies.

THEOREM 3.4. Let B = 2@‘for any p > 2.54725. The number of vectors a = (a,, . . . ) a,,) with 1 I ai I B for 1 5 i 5 n for which e is the shortest vector in L(a, e)


for all 0- 1 vectors e for which

239

is

B” + O(Bn-c”8’(logB)2), (3.39)

where c2(p) = 1 - 2.54725/p > 0.

PROOF. Sum the result of Theorem 3.1 over all 2”-’ - 1 vectors e satisfying (3.38). The resulting bound is

O( n2 “S,

This is certainly an upper bound for the error term in (3.39). Now use

< B 1 -z(p) - 9

and the result follows. Cl

Theorem 3.4 makes an assertion about lattices of density d(a) 5 0.393 < (2.54725)-l. Now we prove the main result on the performance of Algorithm SV.

THEOREM 3.5. Let B > 2(“2+8)n2 for some fixed p > 0. Then the number of vectors a = (a,, . . . , a,) with 1 5 ai < B for all i for which Algorithm SV will succeed for all 0- 1 vectors e is

B” + O(Bn-C~(p)+4(lunn)/n),

where c@) = 2p/( 1 + 2p) > 0.

This theorem asserts then that for any fixed P > 0 one can solve the subset sum problem for “almost all” a = (a,, . . . , a,) for which d(a) < (1 + ,8)-‘n-l, provided n 2 no(P).

PROOF OF THEOREM 3.5. At least one of the two lattice problems that Algorithm SV considers has an associated e satisfying

j, ei 5 tn. (3.40)

Now suppose, for this lattice problem, that the lattice L(a, e) has the property that all vectors w in L(a, e) that are not a scalar multiple of e satisfy

(I w 11 > n2”-2 r 2”-’ 11 e 11

using (3.40). Then Proposition 2.1 guarantees that some vector Xe must appear in the reduced basis produced by the L3 algorithm applied to L(a, e). Hence Algorithm SV succeeds in this case. (We remark that if Xe appears in a reduced basis, then necessarily X = + 1.)

It remains to bound the exceptional cases in which this does not occur. We use the bound of Theorem 3.1 with R = n2”-2, summing over all e satisfying (3.40) to obtain the upper bound

O(n2”S,(n2”-2)B”-1 log(n2”-‘B)), (3.41)


for the exceptional cases. Then, using the trivial bound

S,,(R) 5 (2R”’ + 1)” 4 3”R”“,

we can easily obtain an upper bound for (3.41) of

ot2 n2/2+nlW7Bn-l lo,&2”B)).

Since B 2 2(‘/2+8)rq2, we find that for large n,

and

log(n2”B) I B”“,

where c3(p) = 2,8( 1 + 2@). 0

Theorem 3.5 can be sharpened by using an improved form of the L3 algorithm. Lenstra et al. [ 1311 actually defined a notion of y-reduced basis, which depends on a parameter y satisfying a 5 y < 1. The notion of reduced basis corresponds to choosing y = a; the general definition is given in the Appendix. For a y-reduced basis the bound (12.2) of Proposition 2.1 is replaced by

IIVil12~ & ( ) n-1

yj: II x II 2. X#O

They gave an algorithm, which we may call the L3( y) algorithm, that produces a y-reduced basis. An analog of Proposition 2.2 holds for this algorithm, in which the constants implied by the 0 symbols depend on the choice of y. We can modify Algorithm SV to use the L3(y) algorithm and obtain Algorithm SV(y). Then we may prove Theorem 3.5 for Algorithm SV( JJ), obtaining a similar bound for B = 2(1+B)c(y)n2 where c(y) = 1 log2(4/(4y - 1)). With this bound, letting y + 1, we get a result that asserts that we can solve the subset sum problem for “almost all” problems of density d(a) < (2 - E) (log2(4/3))-‘n-l.

4. Computational Results We performed extensive computational tests using Algorithm SV. We tested several variants of Algorithm SV, obtained by modifying the L3 algorithm in ways designed to improve its chance of finding the shortest vector in a lattice. We considered two such modifications.

(1) Running the L3( y) algorithm for y = 1 instead of y = $. In the case y = 1, the algorithm is not proved to run in polynomial time; however, in practice, it takes about three times as long as the algorithm with y = i. It seems to find much shorter vectors than the algorithm with y = $.

(2) Running the L3 algorithm several times for the same lattice, starting with different initial ordered bases for the lattice. The rationale for this is that running the L3 algorithm with different initial ordered bases will tend to produce different reduced bases; finding several reduced bases improves our chance of finding one containing the shiortest vector in the lattice. We obtained different ordered bases by randomly permuting the given ordered basis.

Our initial computations were done on a VAX 1 l/780 using the Vaxima symbolic manipulation system on lattices of dimension 521. Then we made


TABLE I. TEST RESULTS USING THE L’(y) ALGORITHM WITH y = 1

241

Dimension n log2B

Number of Successes Success Rate Density Number of after 5

d Tests 1 trial 5 trials Trials

14 16 0.875 50 42 48 0.96 20 0.700 50 50 50 1 .oo

20 24 0.833 50 16 36 0.72 30 0.667 50 47 50 1 .oo 36 0.555 50 50 50 1 .oo

26 30 0.867 50 IO 23 0.46 36 0.722 50 29 49 0.98 44 0.591 50 42 50 1 .oo

30 36 0.833 50 10 19 0.38 44 0.682 50 17 38 0.76 45 0.667 IO 5 8 0.80 51 0.588 IO 7 10 1 .oo 60 0.500 10 8 10 1 .oo

40 60 0.667 9 2 6 0.67 68 0.588 9 4 8 0.89 80 0.500 10 8 10 1 .oo

50 85 0.588 5 1 1 0.20 100 0.500 3 1 2 0.67

extensive computations on a CRAY- 1, using standard FORTRAN double-precision arithmetic when possible and otherwise the Brent MP (multiprecision) package [3]. The version of the L3( y) algorithm we used differed from that described in [ 131 in the use of floating-point approximations to the p;j. This version of the algorithm is not guaranteed to produce a reduced basis in polynomial time, but in practice it does. The running times of our implementation on the CRAY-1 using the Brent MP package were proportional to n(logB)3 over a wide range of values of n and B, up to n = 80. The n = 50, log2B = 100 runs of the L3( 1) algorithm described below took on the order of 14 minutes of CPU time on a CRAY- 1.

The results of the most systematic of our tests are presented in Table I. In these tests we fixed the dimension of the subset sum problem n and fixed log& and then we generated at random a vector a = (a,, . . . , a,) with 1 I ai 5 B, and defined avectore=(el, . . . . en) by ei = 1 for 1 5 i 5 n/2 and ei = 0 otherwise. We ran the L3( y) algorithm with y = 1 on a basis of the lattice L(a, M(a, e)) obtained by randomly permuting the rows of the basis (2.4). The run was a success if +e appeared in the reduced basis. In cases of failure, the L3 algorithm was applied again to another permutation of the basis (2.4), and this was repeated for up to live trials.

Table I defines the density d of a problem as n/log2B. It reports the number of successes both on the first trial and after five trials of permuting the basis. The final column gives the success rate after five permutations of the basis. We observed that when the run was a success and fe appeared in the reduced basis, it was not always the first vector in the reduced basis. In most cases in which +e appeared in the reduced basis, it was the shortest vector in the reduced basis. If we use an observed success rate of 1 .OO as an estimate for an upper bound for the cutoff value de(n), we have d,(30) I 0.60, d,(40) 5 0.50. This suggests to us that d=(n) & 0 as n + m.


We also examined the effect of varying the parameter y in the L3( y) algorithm. The effect of setting y = 1 is to increase the running time (by roughly a factor of 3 compared with tlhe usual variant with y = a) but also to produce considerably shorter vectors in the reduced basis, and thereby to increase the chances of success of Algorithm SW.. For example, although the 50 runs with n = 26, log2B = 36 described in Table I led to 49 successes for y = 1 with 29 of them on the first try, the same algorithm with y = $ achieved only 19 successes, 2 of them on the first try. We encountered a few cases where values of y < 1 led to success, whereas y = 1 did not, but such cases were rare.

Lenstra et al. [ 131 prove that if VT, . . . , v? is a reduced basis of a lattice L, and d(L) denotes the determinant of the lattice (which equals the determinant of the matrix formed by the vectors VT, . . . , v,*>, then

r = rI~=l II VTII d(L)

satisfies

4

( )

n(n- I )/4

r5 4y-1 * (4.1)

Our runs for n I 50 indicate that for most L-reduced lattices In r is on the order of n2/50 for y = I, and on the order of n2/33 for y = 3/4.

5. Discussion (1) Theorem 3.3 implies that “almost all” subset sum problems (1.1) with d(a)

< 0.645 can be solved in polynomial time if one can find a polynomial time algorithm that “almost always” finds the shortest Euclidean norm vector in an integer lattice L. This possibility may seem unlikely in view of the result that the corresponding sup norm minimum vector problem is NP-hard (see [IO]). On the other hand, there are natural NP-complete problems for which polynomial-time algorithms exist that solve “almost all” instances of the problem, (Wilf [ 193).

(2) We conjecture that Theorem 3.3 is sharp in the sense that there is a critical density PO below which Theorem 3.3 is true for “almost all” subset sum problems of density d(a) 5 /3 for any ,8 < ,80 and true for “almost no” subset sum problems with d(a) L p for any fixed /3 > PO; here we average not only over all sets aI, . . . , a, of the given density, but also over all binary vectors e, so that C ei - n/2 holds for almost all of them. Furthermore, we conjecture that this critical density is

where

/I,, = (Co)-’ = 0.645 . . . , (5.1)

co = ;~(lopiSn (;)) = 1.54725 . . . .

We are unable to prove these conjectures rigorously. It is possible to use arguments similar to those used in the proof of Theorem 3.1 to obtain a lower bound of Q(S,,(n/2)B”-‘) for the number of pairs (L, x), where L is a lattice in h(B, e) containing the ve:ctor x, where 11 x /I2 5 n/2. Using this result one can show that the expected number of lattice points x with II x iI2 d n/2 in a lattice drawn from h(B, e) with CX, ei = [n/2] and B = 2O” is at least 2’B-po-“” for any fixed t > 0, as n ---, cQ. The conjectures above would follow from a proof that “almost all” lattices


in A(B, e) contain around the expected number of short vectors x with ]I x 11’ I n/2.

(3) Algorithm SV can be expected to solve even relatively dense subset sum problems when the solution has C e; either very small or very large, since then the e vector in one of the lattices considered by the algorithm will be very short. For example, if C e; - n/4, the critical density changes from 0.645 to 0.94. For a random problem, we expect C ei - n/2 by the law. of large numbers. In data communication one often encounters a preponderance of zeros in the message e, in which case Algorithm SV should succeed on much higher density problems for those particular e. We have verified this experimentally for n I 40.

(4) For what kinds of low-density vectors a does Algorithm SV fail? This question is important if we want to design a knapsack-type public-key cryptosystem that is immune to this attack.

It is easy to see that Theorem 3.3 does not hold for vectors a = (a,, . . . , a,), which satisfy a small linear dependency

i a;X; = 0 c

i=l

with C X3 small. In this case every lattice L(a, M) contains the short vector VI = (A,, . . . ) X,, 0). However Algorithm SV may still succeed in this case, since it may find both vo = (et, . . . , e,,, 0) and VI in the reduced basis it produces. Indeed this has occurred on numerical examples. It appears that for this attack to fail a must have many small linear dependencies. Two problems immediately face the would-be cipher designer:

(i) A fast decryption algorithm for such a = (aI, . . . , a,) is needed. (ii) The existence of a large number of linear dependencies in the ai’s forms a

point of attack for cryptanalysis of such problems.

(5) How are the results of Theorem 3.3 and 3.6 to be interpreted as applying to knapsack-type public-key cryptosystems? Indeed, although these results apply to “almost all” subset sum problems in the appropriate range, the particular subset sum problems arising from the knapsack cryptosystems proposed so far form only an infinitesimal fraction of “subset sum” problems in this range. Therefore it could be argued that perhaps Algorithm SV will not succeed on them.

The simplest way to address this criticism is by actually testing Algorithm SV on such subset sum problems. We have performed such tests on three subset sum problems, with n = 20, B - 240, that were constructed using a doubly iterated Merkle-Hellman knapsack [ 151. All three tests were successful. In fact, we expect that Algorithm SV will tend to be more successful on vectors a arising from knapsack cryptosystems than for random vectors, because these a automatically have all small linear dependencies of the form

!, &Xi = 0; Vi, Xi = 1, 0, or - 1,

ruled out by the need for unique decipherability of encrypted messages. (6) E. Brickell (personal communication) has suggested that “dense” subset

sum problems might be solved by converting them to “low-density” subset sum problems through one or more modular multiplications. To do this, let

j, aixi = M (5.3)


be the original problem, and select a pair ( W, Y) subject to

Y > i a;; (w, r) = 4 i=l

and form

bi E Wa; (mod Y); 0 5 bi < Y. (5.4)

Algorithm SV presumably does not work on the original problem because the (ai) satisfy many small linear dependencies

$, ai-% = 0. (5.5)

Indeed, we indicated in (2) of this section that for subset sum problems of density /3 > ,&, where /IO is the critical density, we expect that there are many such small linear depeindencies (5.5), on the order of 2(8-Po+t)“. Now a single modular multiplication will destroy some of these dependencies. Indeed, if we write bi = Wai - kiY, then lwe see that

i bixi = 0 i=l

(5.6)

holds if and only if

i kiXi = 0. i=l

This last condition is equivalent to n WUi

c i-1 Y x; = 0,

i=l

(5.7)

(5.8)

where (t ) denotes the fractional part oft. We expect a given small linear dependency (5.5) to hold after a single modularmultiplication with probability on the order of n-l/* The total number of such small linear dependencies is thus cut down by at most’a factor of r;!‘/*. (Note that new small linear dependencies may be introduced; the probability of this is quite low, however.) Therefore, we expect that it requires on the order of y1 successive modular multiplications to arrive at a subset sum problem in which all of the small linear dependencies have been eliminated and for which Algorithm SV can be expected to succeed.

We expect that repeated modular multiplication used in this way are of little help in solving the original subset sum problem (5.3). This is because a single modular multiplication transforms the original subset sum problem into one of n different subset sum problems, for if

M’ = WM (mod Y), OaM’5 Y,

then we only know that

M’ = i biXi - kY i=l

holds for some k with 0 I k 5 n. A probabilistic argument suggests that usually k is on the order of n ‘I*, so that about 12 ‘I* subset sum problems after the modular multiplication by ( W, Y) have to be examined to solve the original problem (5.3). This blowup by a factor of n ‘/* essentially cancels the n-l’* reduction in small


linear dependencies; after n successive modular multiplications, we would have exponentially many subset sum problems to search, exactly one of which corresponds to the original problem (5.3).

(7) The success of Brickell’s method [5] appears to be based on similar principles to our method. However, it seems difficult to analyze. His method has two practical advantages over our method:

(i) It has an initial preprocessing step with the same asymptotic running time as our method. If it succeeds, however, it can subsequently solve all subset sum problems with the same a for each M in time O(n2(log(M + ]I a ]]))2) or less.

(ii) If it succeeds, it can afterwards test for infeasibility of (1.1) for a given M in time O(n2(log(M + 11 a ]1))2) or less.

The cutoff density d(a) below which Brickell’s method can be expected to be successful may turn out to be smaller than that for Algorithm SV. This is because it must succeed in solving all problems ( 1.1) for a given a when it succeeds (compare Theorems 3.3 and 3.4).

(8) When trying to solve many subset sum problems with the same a, it might be possible to speed up Algorithm SV by first reducing a lattice L = L(a, M) with A4 = M* very large, say M* = (max Ui)2. The reduced basis would consist of y1 vectors, call them by, . . . , bn*, that are linear combinations of bi, . . . , b, only, and of one vector, call it b,*,l, that is long and depends on b,,+, also. Then, to solve a subset sum problem with a given M, we can reduce a basis consisting of b?, . . . , b? and (0, . . . , 0, M). Since the b?are short, this reduction ought to be very rapid.

Appendix. Reduced Basis of a Lattice Let [v,, . . . , v,] be an ordered basis of a lattice L. Associated to this basis is the set of vectors [VT, . . . , vn*] obtained by applying the Gram-Schmidt process to [VI, . . . , VA namely,

v:= VI vt = v2 - I12.1vt

where

(Vi, $7 for j < i.

Let y be a parameter satisfying $ I y < 1. Lenstra et al. define [VI, . . . , v,] to be y- reduced provided that:

(1) 11 VT+ /.Li,i-1Vtl II2 L y]lVt* II2 for 2 I i I n, (2) ] pij 1 5 $ for all i > j,

both hold. The definition of reduced basis used in [ 131 (and in this paper) takes y= 3.

This definition of y-reduced basis can be reformulated in another way. Let 5 denote the R-subspace of R” spanned by [vl, . . . , vj-l] (equivalently, [v?, . . . , v:,]). Let vi(j) for i I j denote the projection of vi onto the orthogonal complement qof 5. In particular vi(i) = v? Then the conditions above for a basis to be y- reduced can be written as

(1) II vi0 - 1) II 2 2 Yll Vi-l(i - 1) 112, (2) 11 Vi( j + 1) - Vi(j) 11 5 t 11 Vj( j) 11, for all i > j.


REFERENCES

1. ADLEMAN, L.M. On breaking generalized knapsack public key cryptosystems. In Proceedings of the 15th ACM Symposium on Theory of Computing (Boston, Mass., Apr. 25-27). ACM, New York, 1983,402-412.

2. AFFLERBACH, L. Minkowskische Reduktionsbedingungen fiir positiv definite quadratische Formen in 5 Variabeln. n4onatsh. Math. 94 (1982), 1-8.

3. BRENT, R.P. A Fortran multiple-precision arithmetic package. ACM Trans. Math. Softw. 4, 1 (Mar. 1978), 57-.70.

4. BRENTJES, A. J. Multi-dimensional continued fraction algorithms. Mathematical Centre Tract No. 145, Matematisch Centrum, Amsterdam, The Netherlands, 198 1.

5. BRICKELL, E. Are most low density knapsacks solvable in polynomial time? In Proceedings of the 14th Southeastern Conference on Combinatorics, Graph Theory, and Computing, 1983. Congressus Numerantium, Vol. 39, 1983, pp. 145-156.

6. DIETER, U. How to calculate shortest vectors in a lattice. Math. Comput. 29 (1975), 827-833. 7. FERGUSON, H. R. P., AND FORCADE, R. W. Multidimensional Euclidean algorithms. J. reine angew.

Math. 344(1982), 171-181. 8. CAREY, M. R., AND JOHNSON, D. S. Computers and Intractability: A Guide to the Theory of NP-

Completeness. W. H. Freeman and Co., San Francisco, 1979. 9. KALTOFEN, E. On the complexity of finding short vectors in integer lattices. In Computer Algebra:

Proceedings of EUROCAL ‘83, European Computer Algebra Conference, J. A. VanHulzen, Ed. Lecture Notes in Computer Science, vol. 162. Springer-Verlag, New York, 1983, pp. 236-244.

10. LAGARIAS, J.C. The computational complexity of simultaneous Diophantine approximation problems. SIAM J Comput. 14 (1985), to be published.

11. LAGARIAS, J. C. Knapsack-type public key cryptosystems and Diophantine approximation, (Ex- tended Abstract). In Advances in Cryptology, Proceedings of CRYPTO-83 (Santa Barbara, Aug.), D. Chaum, Ed. Plenum, New York, 1984, pp. 3-24.

12. LEMPEL, A. Cryptography in transition: A survey. Comput. Surv. 11 (1979), 285-304. 13. LENSTRA, A.K., LENSTRA, H. W., JR., AND LovAsz, L. Factoring polynomials with rational

coefficients. Math. Anna/en 261 (1982), 5 15-534. 14. MAZO, J. E., AND ODLYZKO, A.M. Lattice points in high-dimensional spheres, paper in prepara-

tion. 15. MERKLE, R.C., AND HELLMAN, M.E. Hiding information and signatures in trap-door knapsacks.

IEEE Trans. InJ: Theory IT-24 (1978), 525-530. 16. ODLYZKO, A.M. Cryptanalytic attacks on the multiplicative knapsack cryptosystem and on

Shamir’s fast signature scheme. IEEE Trans. Inf: Theory IT-30, 4 (July 1984), 584-60 1. 17. SHAMIR, A. A polynomial time algorithm for breaking the Merkle-Hellman cryptosystem. In

Proceedings of the 23rd IEEE Symposium on Foundations of Computer Science. IEEE, New York, 1982, pp. 145-152.

18. SHAMIR, A. Embedding cryptographic trapdoors in arbitrary knapsack systems. Inj Proc. Left. I7 (1983), 77-79.

19. WILF, H. S. Backtrack: An 0( 1) expected time algorithm for the graph coloring problem. Inf Proc. Left. 18 (1984), 11’3-121.

RECEIVED AUGUST 1983; REVISED MARCH 1984; ACCEPTED AUGUST 1984

Joumalofthe Association fcaComputing Machinery, Vol. 32, No. I,January 1985.

Documents

Solving Low-Density Subset Sum Problems...The subset sum problem is a well-known NP-complete set recognition problem [8, p. 2261. The problem is stated as follows: Given a set A =